怎样用Sniffer监听交换机数据包(国外英语资料).doc

怎样用Sniffer监听交换机数据包 How do I use Sniffer to monitor gateway packets? 2009-09-17 In a switched Ethernet environment, communication between two workstations is generally not intercepted by the third. In some cases, we might need to do such listening, such as protocol analysis, traffic analysis, and intrusion detection. To this end, we can set Cisco switches (Switched, Port, Analyzer, SPAN Port Analyzer) features, or early port mirroring, monitoring port functionality. The object that listens may be one or more switch ports, or the entire VLAN. If you want to listen to the port (source) or VLAN and port connection monitoring workstation (port) in the same switch, we only need to configure the SPAN; if not in the same switch, need to configure the RSPAN (Remote SPAN). Different switches have different restrictions on SPAN, such as the 2900XL switch, the source port and destination port must be in the same VLAN, some switches do not support RSPAN, and so on, see the device documentation. When configuring SPAN, the parameters we need to provide are the source port or the VLAN number, and the target port. 4000/6000 CatOS switch: The set span 6/17 6/19 //SPAN: source port is 6/17 and the destination port is 6/19 2950/3550/4000IOS/6000IOS switch: Monitor session 1 local //SPAN Monitor session 1 source interface FastEthernet 0/17 both / / source port, can also be a VLAN Monitor session 1 destination interface FastEthernet 0/19 / / destination port 2900/3500XL switch: Interface FastEthernet 0/19 / / destination port Port monitor FastEthernet 0/17 / / source port 1900 switches: (or using the menu [M] Monitoring) Monitor-port monitored 0/17 (0/17 / source port and 0/18 port) Monitor-port monitored 0/18 Monitor-port port 0/19 / / destination port Monitor-port / / to monitor When configuring RSPAN, we first have to define a VLAN of type RSPAN. In ordinary VLAN if the source and destination hosts in the same switch, communication between them is unicast need not be transmitted to o